Index Local Machine

[eantonio]

I'm very new to Splunk. I just installed it in my environment and in the process of testing it. I'm wondering why a lot of the options/settings are giving me the option to Index the local Splunk Server. Isn't the point of Splunk is to Index/Manage Remote Servers? Why is there a need to index/log the local Splunk Server? I installed my Splunk Instance in a brand new virtual server so I don't see the point of pulling logs out of this server.
Thank you for the explanation in advance.

[JSapienza]

This really depends on your intent with splunk. Typically Splunk is used to index data from multiple machines and not just the machine that acting as your splunk search-head and indexer. Data is index in splunk to make it searchable. If you only have your local machine forwarding data then that's all you will see.

This might help clear things up : Distributed Splunk overview

[kdenton · Accepted solution]

You are correct, the entire idea with that is to have your data sent to Splunk for indexing.

Usually you get data to spunk either using the Universal Forwarder, syslog (514) or monitoring remote directories.

I have had one case where I did have a script copy data to another partition on my spunk server to be indexed, but it was a very small amount of data that was being moved and indexed due to some restrictions on our network.

Also, from experience be careful with running spunk on Virtual machines, your index and search performance will vary depending on the amount of data being ingested per minute and as your data set starts to grow.